Audit Sampling: Attribute vs Variables Sampling, the Two Risks in Each, and the Numbers AUD Asks For

An auditor who tests 60 purchase orders for a signature is asking a yes-or-no question about a control. An auditor who confirms 60 receivable balances is estimating an amount. Those are two different kinds of sampling, attribute and variables, and each of them can go wrong in two different directions. AUD does not ask whether you can compute a sample size; it asks whether you know which risk hurts the audit and which merely wastes time, and whether you can tell one from the other when the fact pattern uses a different word.

The standard is AU-C 530, and its ISA twin, ISA 530, is the one SOCPA endorses; the definitions match. What follows is the vocabulary, the two kinds of sampling side by side, what drives sample size in each, how a result is projected to a population, and the forms the questions take.

The vocabulary

Audit sampling is applying a procedure to less than 100% of a population so that all units have a chance of selection, in order to draw a conclusion about the whole. Testing every item above a threshold is not sampling, and neither is testing the items the auditor happens to find interesting; sampling requires that the untested items have a chance of being selected.

Sampling risk is the risk that the auditor's conclusion from the sample differs from the conclusion that testing the whole population would have given. It is the risk the sample was unrepresentative, and it can be measured and controlled with statistical methods. Non-sampling risk is every other way the conclusion can be wrong: an inappropriate procedure, a misread document, a deviation the auditor failed to recognise. It cannot be quantified and is controlled by supervision and review.

Statistical sampling uses random selection and probability theory to measure sampling risk. Non-statistical sampling uses the auditor's judgement for selection, size or both. Both are permitted, both require the result to be projected to the population, and the choice does not change the sufficiency of the evidence required.

The two kinds, side by side

	Attribute sampling	Variables sampling
Used for	Tests of controls	Substantive tests of details
Question	What is the rate of deviation from a control?	What is the amount of misstatement in a balance?
Unit	An occurrence: an invoice, an approval, a reconciliation	A monetary amount: a balance, an item, or a single riyal
Result	A deviation rate, compared with a tolerable rate	A projected misstatement, compared with tolerable misstatement
Risk that hurts effectiveness	Risk of overreliance: assessing control risk too low, the control looks better than it is	Risk of incorrect acceptance: accepting a balance that is materially misstated
Risk that hurts efficiency	Risk of underreliance: assessing control risk too high, extra substantive work	Risk of incorrect rejection: rejecting a balance that is fairly stated, extra work

The two rows at the bottom are the ones AUD tests most. Each kind of sampling has one risk that leads to a wrong opinion and one that leads to wasted work, and the wrong-opinion risk is the one the auditor controls with the sample size. Overreliance and incorrect acceptance are the effectiveness risks; underreliance and incorrect rejection are the efficiency risks. A question that describes an auditor concluding a control was operating when it was not is describing overreliance; one that describes an auditor asking for more evidence about a balance that turned out to be right is describing incorrect rejection.

Attribute sampling

The auditor sets three parameters, and each one moves the sample size in a fixed direction.

Parameter	Meaning	Effect on sample size
Tolerable deviation rate	The maximum rate of deviation the auditor will accept and still rely on the control	Inverse: a lower tolerable rate needs a larger sample
Expected deviation rate	The rate the auditor expects to find, from prior years or a pilot	Direct: a higher expected rate needs a larger sample
Acceptable risk of overreliance	How much sampling risk the auditor accepts, typically 5 or 10%	Inverse: less acceptable risk needs a larger sample
Population size	The number of occurrences	Negligible, once the population is large

The last row is the counterintuitive one and it is examined. Doubling a population of 20,000 invoices barely changes the sample size needed to test them; the arithmetic of sampling depends on the rates, not the count.

Evaluation. The auditor finds three deviations in a sample of 60: a sample deviation rate of 5%. The conclusion is not that the population's rate is 5%. Statistical tables add an allowance for sampling risk to produce a computed upper deviation rate, perhaps 11% at a 5% risk of overreliance, and it is that upper rate that is compared with the tolerable rate. If the tolerable rate was 8%, the control cannot be relied on as planned, and the auditor either reduces reliance and expands substantive work or tests more items. A single deviation that is a fraud is not a rate question at all; it is a risk assessment question.

Two variants appear. Discovery sampling is attribute sampling with an expected rate of zero, used to search for a single critical deviation such as a forged approval. Sequential or stop-or-go sampling tests in stages and stops as soon as the evidence supports the conclusion, which is efficient when deviations are rare.

Variables sampling

The parameters mirror the attribute case, with one addition.

Parameter	Effect on sample size
Tolerable misstatement	Inverse
Expected misstatement	Direct
Acceptable risk of incorrect acceptance	Inverse
Variability of the population (standard deviation)	Direct, for classical methods; not a factor in monetary unit sampling
Population size	Direct, but small

Tolerable misstatement is where this article meets materiality and performance materiality: it is performance materiality applied to this population, and it is the number the projected misstatement is judged against.

Classical variables sampling treats each item as a unit and uses the sample's mean, ratio or difference to estimate the population. Mean-per-unit estimation multiplies the average audited value by the number of items; ratio estimation applies the ratio of audited to book value in the sample to the population's book value; difference estimation projects the average difference per item. Ratio and difference methods need some misstatements in the sample to work and are more efficient when misstatements are proportional to size. Classical methods handle understatements and zero or negative balances well, and they need an estimate of the population's variability, which is why stratification, dividing the population into layers of similar size, cuts sample sizes sharply.

Monetary unit sampling, also called probability-proportional-to-size sampling, treats every riyal as a sampling unit, so a 500,000 balance is 500,000 units and is 100 times as likely to be selected as a 5,000 balance. The population is divided by the sample size to get a sampling interval, and every item containing the selected riyal is examined. Its strengths are that it needs no variability estimate, that it automatically selects the large items, and that it gives a small sample when little misstatement is expected. Its weaknesses are the mirror: it is poor at finding understatements, it cannot select zero or negative balances, and it becomes inefficient when many misstatements are expected. It is the method of choice for overstated receivables, and the wrong choice for a search for unrecorded liabilities.

Projecting a result

Every sample result is projected to the population, statistical or not. A sample of 200 receivable items with a book value of 400,000 is audited at 392,000: a misstatement of 8,000, or 2% of book value. Applied to a population with a book value of 10,000,000, the projected misstatement by the ratio method is 200,000. If tolerable misstatement was set at 300,000, the auditor then has to consider whether 200,000 plus an allowance for sampling risk leaves enough room; with a statistical method the allowance is computed, and with a non-statistical one the auditor judges. A projected misstatement close to the tolerable amount is not acceptable, because the allowance eats the margin.

In monetary unit sampling the projection works by tainting. An item with a book value of 1,000 and an audited value of 800 is 20% tainted; the tainting is applied to the sampling interval, not to the item, so with an interval of 50,000 that item projects a misstatement of 10,000. Items larger than the interval are not projected at all; their actual misstatement is used, because they were certain to be selected.

The projected misstatement goes into the auditor's accumulation of misstatements under AU-C 450 as a projected misstatement, distinct from the factual ones found in the sample, and the entity is asked to investigate and correct the population, not just the sampled items.

How AUD asks

Question pattern	Answer
Auditor relies on a control that was not operating	Risk of overreliance; an effectiveness risk
Auditor rejects a fairly stated balance	Risk of incorrect rejection; an efficiency risk
Which change increases the attribute sample size	Lower tolerable rate, higher expected rate, or lower acceptable risk of overreliance
Which factor does not affect the attribute sample size	Population size, for a large population
Searching for understatements or with many zero balances	Classical variables, not monetary unit sampling
Expected misstatement is low, overstatement is the concern	Monetary unit sampling
Sample deviation rate 5%, tolerable rate 5%	Cannot rely: the upper limit exceeds the tolerable rate once sampling risk is added
Non-statistical sample, "must the result be projected"	Yes; projection is required regardless of method

Where to practise this

Sampling questions are decidable once the four risks and the direction of each parameter are fixed in memory, and they stay decidable only with practice. Prepito's AUD course covers attribute sampling, classical and monetary unit variables sampling and the evaluation of results with practice questions that name the risk in every option. The SOCPA Audit course covers ISA 530 as endorsed. For the model the samples serve, see The Audit Risk Model and Internal Control; for the section as a whole, the AUD study guide.

---

Sources: AICPA, Statements on Auditing Standards currently effective (AU-C 530 and 450), PCAOB AS 2315, Audit Sampling, IFAC profile of Saudi Arabia on SOCPA's adoption of the ISAs. Worked figures are illustrative and the upper deviation rate quoted is an example, not a table value; confirm the current standards for a specific engagement.